How to sum a set of values for similar fields from JSON data to calculate a percentage?

[echeren]

I am trying to sum a set of values from some JSON files. The structure of the response is identical, but I want to group the sum by metricid. My basic search does gives me a count by metric ID, but then I can't seem to be able to calculate a percentage. I want to be able to calculate my health by substracting the very slow calls from the total number of calls and *100/ total number of calls.

index="xxx"  source="E:\\path\\REST\\test*"  metricId!=9011737 metricId!=9012116 | stats sum(metricValues{}.sum) by metricId 

Below is an example of my data:

{
"frequency": "ONE_MIN",
"metricId": 90188,
"metricName": "BTM|Application Summary|Component:6710|Number of Very Slow Calls",
"metricPath": "Overall Application Performance|xxx Core|Number of Very Slow Calls",
"metricValues": [ {
"count": 155,
"current": 3,
"max": 0,
"min": 0,
"occurrences": 0,
"standardDeviation": 0,
"startTimeInMillis": 1477421100000,
"sum": 552,
"useRange": false,
"value": 552
}]
}

{
"frequency": "ONE_MIN",
"metricId": 9011736,
"metricName": "BTM|Application Summary|Component:6710|Calls per Minute",
"metricPath": "Overall Application Performance|XXX Core|Calls per Minute",
"metricValues": [ {
"count": 397,
"current": 0,
"max": 0,
"min": 0,
"occurrences": 0,
"standardDeviation": 0,
"startTimeInMillis": 1477421100000,
"sum": 81332,
"useRange": false,
"value": 5423
}]
}

[sundareshr]

Assuming your JSON is well formed and all fields are extracted, try putting your field name within single or double quotes

index="xxx" source="E:\\path\\REST\\test*" metricId!=9011737 metricId!=9012116 | stats sum('metricValues{}.sum') as total by metricId

*OR*

index="xxx" source="E:\\path\\REST\\test*" metricId!=9011737 metricId!=9012116 | rename 'metricValues{}.sum' AS s | stats sum(s) as total by metricId